Hi There, I have ingested the csv file via Splunk UF and I want to remove certain events that contains same field value, for example, field1 = xyz, abc, pqr,.... field2 = xyz I want to send the data to null queue if field1 = xyz and field2 = xyz This is my props.conf : [<sourcetype>] CHARSET = UTF-8 SHOULD_LINEMERGE = false NO_BINARY_CHECK = true LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true INDEXED_EXTRACTIONS = csv KV_MODE = none category = Structured disabled = false pulldown_type = true Any help would be appreciated. Thanks
... View more